The current Near Field Communication (“NFC”) eco-system relies on a piece of hardware commonly referred to as a “secure element” installed on communication devices to provide a secure operating environment for financial transactions, transit ticketing, physical security access, and other functions. A secure element generally includes its own operating environment with a tamper-proof microprocessor, memory, and operating system. A Trusted Service Manager (TSM), among other things, installs, provisions, and personalizes the secure element. The secure element has one or more keys that are typically installed at manufacture time. A corresponding key is shared by the TSM so that the TSM can establish a cryptographically secure channel to the secure element for installation, provisioning, and personalization of the secure element while the device having the secure element is in the possession of an end user. In this way, the secure element can remain secure even if the host CPU in the device has been compromised.
The problem with current NFC systems is that there is a tight coupling between the secure element and the TSM. For current deployments, only one TSM has access to the keys of a particular secure element. Therefore, the end user can choose to provision secure element features that are supplied by the one TSM only. The manufacturer of the device typically chooses this TSM. For example, a smart phone manufacturer may select the TSM for smart phones under guidance from a Mobile Network Operator (“MNO”), such as SPRINT or VERIZON, that purchases the smart phone rather than the end user. Thus, the TSM features available to the end user may not be in the end user's interest. As an example, the MNO may have a business relationship with one payment provider, such as MASTERCARD or BANK of AMERICA, only. That TSM may allow the secure element to be provisioned with payment instructions from the one payment provider only. Thus, the end user would not be able to access services from other payment providers, such as VISA.
In addition to not being able to change TSM pairings to keys in the secure element, the end user is not able to clear their private data and keys from the secure element. This may be desirable when selling, transferring, returning, or exchanging devices. The end user may wish to remove their information for privacy and security as well as preparing the device to allow the new user to select their own secure services to run on the device.